@lifeaitools/clauth 1.30.6 → 1.30.7

package/cli/commands/scrub.test.js

@@ -1,115 +0,0 @@
-// node --test cli/commands/scrub.test.js
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import {
-  PATTERNS,
-  findTranscripts,
-  scrubFile,
-  isSecretLike,
-  loadExtraPatterns,
-  sessionTargets,
-} from "./scrub.js";
-
-const GH_TOKEN = "ghp_0123456789abcdefABCDEF0123456789abcd"; // ghp_ + 36 chars
-const VAULT_VALUE = "SuperSecretVaultValue_abc123XYZ";        // secret-like literal
-const CUSTOM_SECRET = "MYCORP-TOKEN-998877";                  // only an editable pattern catches it
-
-function seedProjects() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-scrub-"));
-  const sess = path.join(root, "proj", "session-uuid");
-  const sidecarDir = path.join(sess, "tool-results");
-  fs.mkdirSync(sidecarDir, { recursive: true });
-
-  const jsonl = path.join(root, "proj", "session-uuid.jsonl");
-  const txt = path.join(sidecarDir, "toolu_abc.txt");
-  const body = `token=${GH_TOKEN} value=${VAULT_VALUE} custom=${CUSTOM_SECRET}\n`;
-  fs.writeFileSync(jsonl, `{"x":"${body.trim()}"}\n`, "utf-8");
-  fs.writeFileSync(txt, body, "utf-8"); // the sidecar that the old scrubber skipped
-  return { root, jsonl, txt };
-}
-
-test("findTranscripts discovers .jsonl AND tool-results/*.txt sidecars", () => {
-  const { root, jsonl, txt } = seedProjects();
-  const found = findTranscripts(root);
-  assert.ok(found.includes(jsonl), "should find the .jsonl transcript");
-  assert.ok(found.includes(txt), "should find the .txt sidecar (the previously-skipped leak path)");
-});
-
-test("scrubFile redacts the github token in BOTH the jsonl and the sidecar", () => {
-  const { jsonl, txt } = seedProjects();
-  for (const f of [jsonl, txt]) {
-    const n = scrubFile(f, { force: true, patterns: PATTERNS, literals: [] });
-    assert.ok(n >= 1, `expected >=1 redaction in ${path.basename(f)}`);
-    const after = fs.readFileSync(f, "utf-8");
-    assert.ok(!after.includes(GH_TOKEN), "github token must be gone");
-    assert.ok(after.includes("[GITHUB_TOKEN_REDACTED]"), "redaction marker present");
-    assert.ok(after.includes("[CLAUTH-SCRUBBED]"), "file stamped as scrubbed");
-  }
-});
-
-test("vault-value (literal) redaction removes an arbitrary secret regardless of format", () => {
-  const { txt } = seedProjects();
-  const n = scrubFile(txt, { force: true, patterns: [], literals: [{ name: "test-svc", value: VAULT_VALUE }] });
-  assert.equal(n, 1, "exactly one literal occurrence redacted");
-  const after = fs.readFileSync(txt, "utf-8");
-  assert.ok(!after.includes(VAULT_VALUE), "vault value must be gone");
-  assert.ok(after.includes("[CLAUTH:test-svc_REDACTED]"), "labelled vault redaction present");
-});
-
-test("editable patterns file catches a custom secret with no clauth release", () => {
-  const cfg = path.join(os.tmpdir(), `clauth-scrub-patterns-${Date.now()}.json`);
-  fs.writeFileSync(cfg, JSON.stringify([{ pattern: "MYCORP-TOKEN-\\d+", replacement: "[MYCORP_REDACTED]" }]), "utf-8");
-  const extra = loadExtraPatterns(cfg);
-  assert.equal(extra.length, 1, "one extra pattern loaded");
-
-  const { txt } = seedProjects();
-  const n = scrubFile(txt, { force: true, patterns: extra, literals: [] });
-  assert.ok(n >= 1, "custom pattern matched");
-  const after = fs.readFileSync(txt, "utf-8");
-  assert.ok(!after.includes(CUSTOM_SECRET), "custom secret gone");
-  assert.ok(after.includes("[MYCORP_REDACTED]"), "custom replacement applied");
-  fs.rmSync(cfg, { force: true });
-});
-
-test("isSecretLike: accepts real tokens, rejects short/url/whitespace values", () => {
-  assert.ok(isSecretLike(GH_TOKEN), "long token is secret-like");
-  assert.ok(isSecretLike(VAULT_VALUE), "31-char no-space value is secret-like");
-  assert.ok(!isSecretLike("short"), "short value rejected");
-  assert.ok(!isSecretLike("https://research.regendevcorp.com/mcp"), "plain URL rejected");
-  assert.ok(!isSecretLike("has spaces in it value"), "whitespace value rejected");
-  assert.ok(!isSecretLike(""), "empty rejected");
-});
-
-test("sessionTargets returns ONLY the ending session's transcript + its sidecars", () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-sess-"));
-  const proj = path.join(root, "C--proj");
-  const sid = "11112222-3333-4444-5555-666677778888";
-  fs.mkdirSync(path.join(proj, sid, "tool-results"), { recursive: true });
-  const transcript = path.join(proj, `${sid}.jsonl`);
-  const sidecar = path.join(proj, sid, "tool-results", "toolu_x.txt");
-  const otherSession = path.join(proj, "99990000-aaaa-bbbb-cccc-ddddeeeeffff.jsonl");
-  fs.writeFileSync(transcript, "{}\n");
-  fs.writeFileSync(sidecar, "tool output\n");
-  fs.writeFileSync(otherSession, "{}\n"); // a DIFFERENT session — must NOT be included
-
-  const targets = sessionTargets({ transcript_path: transcript, session_id: sid });
-  assert.ok(targets.includes(transcript), "includes the session transcript");
-  assert.ok(targets.includes(sidecar), "includes the session's sidecar");
-  assert.ok(!targets.includes(otherSession), "does NOT include other sessions (session-only)");
-  assert.equal(targets.length, 2, "exactly the 2 session files");
-
-  assert.deepEqual(sessionTargets(null), [], "no hook input → no targets (caller falls back)");
-  assert.deepEqual(sessionTargets({ transcript_path: path.join(root, "nope.jsonl") }), [], "missing file → none");
-});
-
-test("loadExtraPatterns tolerates a missing/malformed file", () => {
-  assert.deepEqual(loadExtraPatterns(path.join(os.tmpdir(), "does-not-exist-xyz.json")), []);
-  const bad = path.join(os.tmpdir(), `clauth-bad-${Date.now()}.json`);
-  fs.writeFileSync(bad, "{ not json", "utf-8");
-  assert.deepEqual(loadExtraPatterns(bad), [], "malformed json → empty, never throws");
-  fs.rmSync(bad, { force: true });
-});

package/cli/enrollment-script.js

@@ -1,82 +0,0 @@
-import fs from "fs";
-import os from "os";
-import path from "path";
-
-function shellSingleQuote(value) {
-  return `'${String(value ?? "").replace(/'/g, "''")}'`;
-}
-
-function posixShellQuote(value) {
-  return `'${String(value ?? "").replace(/'/g, "'\\\"'\\\"'")}'`;
-}
-
-export function enrollmentScriptName(label, target = "windows") {
-  const slug = String(label || "new-computer")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 40) || "new-computer";
-  return `clauth-enroll-${slug}${target === "linux" ? ".sh" : ".ps1"}`;
-}
-
-function windowsScript({ supabaseUrl, anonKey, enrollmentCode }) {
-  return [
-    "$ErrorActionPreference = 'Stop'",
-    "$label = $env:COMPUTERNAME",
-    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
-    "npm install -g @lifeaitools/clauth@latest",
-    ["clauth setup", `--supabase-url ${shellSingleQuote(supabaseUrl)}`, `--anon-key ${shellSingleQuote(anonKey)}`, `--enrollment-code ${shellSingleQuote(enrollmentCode)}`, "--label \"$label\""].join(" "),
-    "clauth serve install",
-    "$self = $PSCommandPath",
-    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; & ('Remove' + '-Item') -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
-  ].join("\r\n");
-}
-
-function linuxScript({ supabaseUrl, anonKey, enrollmentCode }) {
-  return [
-    "#!/usr/bin/env sh",
-    "set -eu",
-    "label=$(hostname)",
-    "as_root() { if [ \"$(id -u)\" -eq 0 ]; then \"$@\"; elif command -v sudo >/dev/null; then sudo \"$@\"; else echo 'Root or sudo is required to install prerequisites.' >&2; exit 1; fi; }",
-    "install_prerequisites() {",
-    "  if command -v apt-get >/dev/null; then as_root apt-get update; as_root apt-get install -y nodejs npm openssl;",
-    "  elif command -v dnf >/dev/null; then as_root dnf install -y nodejs npm openssl;",
-    "  else echo 'Headless enrollment supports systemd hosts with apt-get or dnf. Install Node.js 18+, npm, and openssl, then rerun this script.' >&2; exit 1; fi",
-    "}",
-    "if ! command -v systemctl >/dev/null || ! command -v loginctl >/dev/null; then echo 'Headless enrollment requires systemd and loginctl.' >&2; exit 1; fi",
-    "if ! command -v node >/dev/null || ! command -v npm >/dev/null || ! command -v openssl >/dev/null; then install_prerequisites; fi",
-    "node_major=$(node -p \"process.versions.node.split('.')[0]\")",
-    "if [ \"$node_major\" -lt 18 ]; then echo 'Node.js 18+ is required.' >&2; exit 1; fi",
-    "if ! npm install -g @lifeaitools/clauth@latest; then as_root npm install -g @lifeaitools/clauth@latest; fi",
-    ["clauth setup", `--supabase-url ${posixShellQuote(supabaseUrl)}`, `--anon-key ${posixShellQuote(anonKey)}`, `--enrollment-code ${posixShellQuote(enrollmentCode)}`, '--label "$label"'].join(" "),
-    "user_name=$(id -un)",
-    "if loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; elif as_root loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; else echo 'Could not enable linger for unattended restart.' >&2; exit 1; fi",
-    "if ! test -t 0; then echo 'Headless enrollment requires an interactive TTY to set the vault password.' >&2; exit 1; fi",
-    "restore_echo() { stty echo 2>/dev/null || true; }",
-    "trap restore_echo EXIT HUP INT TERM",
-    "printf 'Re-enter the vault password to enable unattended restart: ' >&2",
-    "stty -echo",
-    "IFS= read -r vault_password",
-    "stty echo",
-    "trap - EXIT HUP INT TERM",
-    "printf '\\n' >&2",
-    "[ -n \"$vault_password\" ] || { echo 'A vault password is required for unattended restart.' >&2; exit 1; }",
-    "printf %s \"$vault_password\" | clauth serve install --pw-stdin",
-    "unset vault_password",
-    "rm -f -- \"$0\"",
-  ].join("\n");
-}
-
-export function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label, target = "windows", appDir } = {}) {
-  if (!["windows", "linux"].includes(target)) throw new Error(`Unsupported enrollment target: ${target}`);
-  const outputDir = appDir || (process.platform === "win32"
-    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
-    : path.join(os.homedir(), ".config", "clauth"));
-  fs.mkdirSync(outputDir, { recursive: true });
-  const scriptPath = path.join(outputDir, enrollmentScriptName(label, target));
-  const script = target === "linux"
-    ? linuxScript({ supabaseUrl, anonKey, enrollmentCode })
-    : windowsScript({ supabaseUrl, anonKey, enrollmentCode });
-  fs.writeFileSync(scriptPath, `${script}\n`, { encoding: "utf8", mode: target === "linux" ? 0o700 : undefined });
-  return scriptPath;
-}

package/cli/webdav-service.js

@@ -1,339 +0,0 @@
-// cli/webdav-service.js
-// WebDAV child-process supervisor — rclone serve webdav
-//
-// ISOLATION: This module has zero coupling to existing fs_* tool handlers.
-// Rollback: set webdav.enabled=false in the config block (or remove it)
-//           + delete this file + remove the two-line import in serve.js.
-//
-// Design: lazy-start. The rclone child spawns on the first fs_dav_setup call.
-// Subsequent calls return the running child's status without restarting.
-// On child crash: exponential-backoff restart loop (2s → 5s → 15s → 60s).
-
-import { spawn, execSync } from "child_process";
-import { writeFileSync, readFileSync, unlinkSync, mkdirSync, readdirSync } from "fs";
-import { tmpdir, homedir } from "os";
-import { join } from "path";
-import crypto from "crypto";
-import * as api from "./api.js";
-import { deriveToken } from "./fingerprint.js";
-
-const WEBDAV_PORT = 8620;
-const WEBDAV_USER = "claude";
-const CRED_NAME   = "webdav-claude";
-const RESTART_DELAYS = [2000, 5000, 15000, 60000];
-
-const APPDATA      = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
-const CONFIG_PATH  = join(APPDATA, "clauth", "webdav-config.json");
-
-const DEFAULT_CONFIG = {
-  enabled: true,
-  port: WEBDAV_PORT,
-  credential: CRED_NAME,
-  upstreams: [],
-};
-
-// ── Config persistence ──────────────────────────────────────────
-
-export function loadConfig() {
-  try {
-    const raw = readFileSync(CONFIG_PATH, "utf8");
-    const cfg = JSON.parse(raw);
-    if (!Array.isArray(cfg.upstreams)) cfg.upstreams = [];
-    return { ...DEFAULT_CONFIG, ...cfg };
-  } catch {
-    return { ...DEFAULT_CONFIG };
-  }
-}
-
-export function saveConfig(cfg) {
-  const dir = join(APPDATA, "clauth");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), "utf8");
-  _fsCfgCache = null;
-}
-
-export function addMount(name, mountPath) {
-  const cfg = loadConfig();
-  if (cfg.upstreams.some(u => u.name === name)) return { error: `Mount '${name}' already exists` };
-  cfg.upstreams.push({ name, path: mountPath });
-  saveConfig(cfg);
-  return { ok: true, upstreams: cfg.upstreams };
-}
-
-export function removeMount(name) {
-  const cfg = loadConfig();
-  const before = cfg.upstreams.length;
-  cfg.upstreams = cfg.upstreams.filter(u => u.name !== name);
-  if (cfg.upstreams.length === before) return { error: `Mount '${name}' not found` };
-  saveConfig(cfg);
-  return { ok: true, upstreams: cfg.upstreams };
-}
-
-export function updateMount(name, updates) {
-  const cfg = loadConfig();
-  const mount = cfg.upstreams.find(u => u.name === name);
-  if (!mount) return { error: `Mount '${name}' not found` };
-  if (updates.credential !== undefined) cfg.credential = updates.credential;
-  saveConfig(cfg);
-  return { ok: true, upstreams: cfg.upstreams };
-}
-
-let _fsCfgCache = null;
-
-// ── Module state ────────────────────────────────────────────────
-let _child       = null;
-let _configPath  = null;
-let _status      = "stopped";  // stopped | starting | running | error
-let _error       = null;
-let _restartCount = 0;
-let _startedAt   = null;
-let _vaultFn     = null;       // () => { password, machineHash }
-let _cfg         = null;
-
-// ── Public API ───────────────────────────────────────────────────
-
-/**
- * Ensure the rclone WebDAV child is running.
- * Idempotent — safe to call multiple times.
- * Returns { ok: true } or { error: string }.
- */
-export async function ensureRunning(vaultFn, config) {
-  if (vaultFn) _vaultFn = vaultFn;
-  if (config)  _cfg     = config;
-  if (!_cfg)   _cfg     = loadConfig();
-
-  if (_status === "running" && _child) return { ok: true };
-  if (_status === "starting")          return { ok: true, message: "still starting" };
-
-  return _startChild();
-}
-
-/** Current supervisor status — safe to call at any time. */
-export function getStatus() {
-  return {
-    status:        _status,
-    port:          WEBDAV_PORT,
-    url:           _status === "running" ? `http://127.0.0.1:${WEBDAV_PORT}` : null,
-    error:         _error || null,
-    restart_count: _restartCount,
-    started_at:    _startedAt || null,
-  };
-}
-
-/** Kill the child and clean up the temp config file. */
-export function shutdown() {
-  if (_child) {
-    _child.removeAllListeners();
-    _child.kill("SIGTERM");
-    _child = null;
-  }
-  _cleanupConfig();
-  _status = "stopped";
-}
-
-/**
- * rclone-compatible AES-CTR "obscure" — same algorithm as `rclone obscure`.
- * Used by fs_dav_setup to embed a non-plaintext credential in the mount script.
- * The result can be passed as RCLONE_CONFIG_xxx_PASS.
- */
-export function rcloneObscure(password) {
-  // Key from rclone source: lib/obscure/obscure.go  cryptKey
-  const key = Buffer.from([
-    0x9c, 0x93, 0x5b, 0x48, 0x73, 0x0a, 0x55, 0x4d,
-    0x6b, 0xfd, 0x7c, 0x63, 0xc8, 0x86, 0xd9, 0x2d,
-    0x02, 0x01, 0x99, 0x87, 0x54, 0xd3, 0x9b, 0xeb,
-    0x40, 0x87, 0x3f, 0xa1, 0x3f, 0x7a, 0xbe, 0x5e,
-  ]);
-  const iv     = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv("aes-256-ctr", key, iv);
-  const ct     = Buffer.concat([cipher.update(Buffer.from(password, "utf8")), cipher.final()]);
-  return Buffer.concat([iv, ct]).toString("base64url");
-}
-
-// ── Internal ─────────────────────────────────────────────────────
-
-async function _startChild() {
-  _status = "starting";
-  _error  = null;
-
-  if (!_cfg?.upstreams?.length) {
-    _status = "error";
-    _error  = "No mount points configured — add them in the clauth dashboard";
-    return { error: _error };
-  }
-
-  // 1. Resolve credential from vault
-  let pass;
-  try {
-    const vault = _vaultFn?.();
-    if (!vault?.password) {
-      _status = "error";
-      _error  = "Vault is locked — unlock clauth first";
-      return { error: _error };
-    }
-    const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
-    const credName = _cfg.credential || CRED_NAME;
-    const result   = await api.retrieve(vault.password, vault.machineHash, token, timestamp, credName);
-    if (!result.value) {
-      _status = "error";
-      _error  = `Credential '${credName}' not found — register it in the vault first`;
-      return { error: _error };
-    }
-    pass = result.value;
-  } catch (err) {
-    _status = "error";
-    _error  = `Credential fetch failed: ${err.message}`;
-    return { error: _error };
-  }
-
-  // 2. Locate rclone
-  const rclonePath = _findRclone();
-  if (!rclonePath) {
-    _status = "error";
-    _error  = "rclone not found — install with: winget install Rclone.Rclone";
-    return { error: _error };
-  }
-
-  // 3. Write rclone config — combine backend with quoted entries for paths with spaces.
-  //    Per rclone docs: "dir=remote:path with space" (quote the whole entry).
-  const mounts = _cfg.upstreams || [];
-  const combineUpstreams = mounts
-    .map(u => `"${u.name}=${u.path.replace(/\\/g, "/")}"`)
-    .join(" ");
-  const configContent = `[srv]\ntype = combine\nupstreams = ${combineUpstreams}\n`;
-  _cleanupConfig();
-  _configPath = join(tmpdir(), `.rclone-webdav-${process.pid}.conf`);
-  try {
-    writeFileSync(_configPath, configContent, { mode: 0o600 });
-  } catch (err) {
-    _status = "error";
-    _error  = `Config write failed: ${err.message}`;
-    return { error: _error };
-  }
-
-  // 4. Spawn rclone
-  return new Promise(resolve => {
-    let settled = false;
-    const settle = (val) => { if (!settled) { settled = true; resolve(val); } };
-
-    try {
-      _child = spawn(rclonePath, [
-        "serve", "webdav", "srv:",
-        "--config",   _configPath,
-        "--addr",     `127.0.0.1:${WEBDAV_PORT}`,
-        "--user",     WEBDAV_USER,
-        "--pass",     pass,
-        "--no-modtime",
-        "--vfs-cache-mode", "full",
-        "--vfs-write-back", "0s",
-        "--ignore-size",
-        "--cache-dir", join(process.env.TEMP || tmpdir(), "rclone-dav-cache"),
-        "--transfers", "4",
-      ], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
-
-    } catch (spawnErr) {
-      _child = null;
-      _status = "error";
-      _error  = spawnErr.message;
-      _cleanupConfig();
-      settle({ error: spawnErr.message });
-      return;
-    }
-
-    _child.stdout.on("data", () => {});
-
-    _child.stderr.on("data", (chunk) => {
-      const line = chunk.toString().trim();
-      if (line.includes("Serving WebDAV") || line.includes("Listening on")) {
-        _status    = "running";
-        _startedAt = new Date().toISOString();
-        settle({ ok: true });
-      }
-      // Surface errors but don't stop on every stderr line — rclone logs normally to stderr
-      if (/\berror\b/i.test(line) || /\bfatal\b/i.test(line)) {
-        _error = line.slice(0, 300);
-      }
-    });
-
-    _child.on("error", (err) => {
-      _child  = null;
-      _status = "error";
-      _error  = err.message;
-      _cleanupConfig();
-      settle({ error: err.message });
-      _scheduleRestart();
-    });
-
-    _child.on("exit", (code, signal) => {
-      _child = null;
-      if (signal === "SIGTERM" || signal === "SIGKILL" || code === 0) {
-        _status = "stopped";
-        _cleanupConfig();
-        return;
-      }
-      _status = "error";
-      _error  = `rclone exited unexpectedly (code=${code} signal=${signal})`;
-      _cleanupConfig();
-      settle({ error: _error });
-      _scheduleRestart();
-    });
-
-    // Optimistic fallback: if rclone doesn't print "Serving WebDAV" within 2s, assume running
-    setTimeout(() => {
-      if (_status === "starting") {
-        _status    = "running";
-        _startedAt = _startedAt || new Date().toISOString();
-      }
-      settle({ ok: true });
-    }, 2000);
-  });
-}
-
-function _scheduleRestart() {
-  const delay = RESTART_DELAYS[Math.min(_restartCount, RESTART_DELAYS.length - 1)];
-  _restartCount++;
-  setTimeout(() => {
-    if (_status === "stopped") return; // intentionally stopped, don't restart
-    _startChild();
-  }, delay);
-}
-
-function _cleanupConfig() {
-  if (_configPath) {
-    try { unlinkSync(_configPath); } catch {}
-    _configPath = null;
-  }
-}
-
-function _findRclone() {
-  const home = homedir();
-  const wingetBase = process.env.LOCALAPPDATA
-    ? join(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Packages")
-    : null;
-  const execOpts = { stdio: "pipe", timeout: 4000, windowsHide: true };
-
-  const candidates = [
-    "rclone",
-    "C:\\Program Files\\rclone\\rclone.exe",
-    join(home, "scoop", "apps", "rclone", "current", "rclone.exe"),
-    "C:\\ProgramData\\scoop\\apps\\rclone\\current\\rclone.exe",
-  ];
-
-  // Winget installs into a version-stamped subdirectory — glob for it
-  if (wingetBase) {
-    const wingetPkg = join(wingetBase, "Rclone.Rclone_Microsoft.Winget.Source_8wekyb3d8bbwe");
-    try {
-      for (const d of readdirSync(wingetPkg)) {
-        if (d.startsWith("rclone-")) candidates.push(join(wingetPkg, d, "rclone.exe"));
-      }
-    } catch {}
-  }
-
-  for (const c of candidates) {
-    try {
-      execSync(`"${c}" version`, execOpts);
-      return c;
-    } catch {}
-  }
-  return null;
-}